General
-
Target
391SXF-pdf.gz
-
Size
14KB
-
Sample
210722-3e5jkbtrq2
-
MD5
4b9bca84a76b99a378984a901448e5aa
-
SHA1
c725306bef0147ede5692525a8136530e134e1f3
-
SHA256
f3d652a1de146b29816ecbd82b3e3f012244c350f245f52bb0954ece786ad4dc
-
SHA512
8dd80b5b33d073670d9bbc606f1f1471071cc86e8f74364b7a2ad78ca2d20c82b35b36b65416239314efda775d2ee2e88c94f35f101d97c7b171c7484f98cd9a
Static task
static1
Behavioral task
behavioral1
Sample
391SXF-pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
391SXF-pdf.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pss.net.pk - Port:
587 - Username:
info@pss.net.pk - Password:
AnisAhmed1980
Targets
-
-
Target
391SXF-pdf.exe
-
Size
29KB
-
MD5
7ca4655dff0318fa097429f12c5f5c5a
-
SHA1
d48404a0bed433fdec9868e57ef561c53e74a9e7
-
SHA256
f3f681c71b259b83868bf64d9cbd877ddef4b78fb67b91e899e0d970e5e5de66
-
SHA512
0bcaaedef0e707a56a773750c82b614da71148e531d1735989f62dcf5d4e78de7dd4c397201c481b7cca782ff9d356d00f7fdc673399c21d66a4fe6e0b4d0988
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-